WordPress Sticky add to cart for Woo Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)

Software Sticky add to cart for Woo Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 982520550df9 Credits Rafie Muhammad Patchsta...

WordPress Ethereum Wallet Plugin < 4.10.6 is vulnerable to Cross Site Scripting (XSS)

Software Ethereum Wallet Type Plugin Vulnerable versions 4.10.6 Fixed in 4.10.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 12d0d0ea37bd Credits Rafie Muhammad Patchstack Requir...

WordPress Custom User Guide Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Custom User Guide Type Plugin Vulnerable versions = 1.0.1 Fixed in 1.1.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 73064f77dce5 Credits Rafie Muhammad Patchstack...

WordPress DeMomentSomTres Address Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)

Software DeMomentSomTres Address Type Plugin Vulnerable versions = 2.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f5877fb71667 Credits Rafie Muhammad Patchstack...

WordPress Page Studio Lite Plugin Plugin <= 4.6 is vulnerable to Cross Site Scripting (XSS)

Software Page Studio Lite Plugin Type Plugin Vulnerable versions = 4.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 58e1ed7adebe Credits Rafie Muhammad Patchstack...

WordPress RevivePress Plugin < 1.5.3 is vulnerable to Cross Site Scripting (XSS)

Software RevivePress Type Plugin Vulnerable versions 1.5.3 Fixed in 1.5.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e19b58dc50bd Credits Rafie Muhammad Patchstack Required...

WordPress Tweet Old Custom Post Plugin <= 19.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Tweet Old Custom Post Type Plugin Vulnerable versions = 19.0.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 052dae11c71c Credits Rafie Muhammad Patchstack...

WordPress Agy – Age verification for WooCommerce Plugin <= 4.3.2 is vulnerable to Cross Site Scripting (XSS)

Software Agy – Age verification for WooCommerce Type Plugin Vulnerable versions = 4.3.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f0f028393287 Credits Rafie...

WordPress Woo Admin Product Notes Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Woo Admin Product Notes Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2c264a5cbee2 Credits Rafie Muhammad Patchstack...

WordPress Atlas – Knowledge Base Plugin <= 6.0 is vulnerable to Cross Site Scripting (XSS)

Software Atlas – Knowledge Base Type Plugin Vulnerable versions = 6.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a66e5ae77863 Credits Rafie Muhammad Patchstack...

WordPress YARPP Plugin <= 5.30.3 is vulnerable to Cross Site Scripting (XSS)

Software YARPP Type Plugin Vulnerable versions = 5.30.3 Fixed in 5.30.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2433 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a7d49568bb15 Credits Lana Codes Required privilege...

WordPress InternalLink Audit Plugin <= 0.1.0 is vulnerable to Cross Site Scripting (XSS)

Software InternalLink Audit Type Plugin Vulnerable versions = 0.1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 61b943d2eda3 Credits Rafie Muhammad Patchstack...

WordPress Livemesh Addons for Beaver Builder Plugin < 3.3 is vulnerable to Cross Site Scripting (XSS)

Software Livemesh Addons for Beaver Builder Type Plugin Vulnerable versions 3.3 Fixed in 3.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a6176790d4e9 Credits Rafie Muhammad...

WordPress Floating Awesome Button Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)

Software Floating Awesome Button Type Plugin Vulnerable versions = 1.6.1 Fixed in 1.7.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a554276c1f96 Credits Rafie Muhammad Patchstac...

WordPress Integrate Google Drive Plugin < 1.2.3 is vulnerable to Cross Site Scripting (XSS)

Software Integrate Google Drive Type Plugin Vulnerable versions 1.2.3 Fixed in 1.2.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5711b66138ac Credits Rafie Muhammad Patchstack...

Claim failure can result to loss of funds

Lines of code Vulnerability details Impact Caller will lose funds through gas fees when claim fails Proof of Concept The claimPrize function allows any caller to claim a prize by providing the necessary parameters: winner address of the winner, tier prize tier, prizeIndex prize index,...

WordPress MF Gig Calendar Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)

Software MF Gig Calendar Type Plugin Vulnerable versions = 1.2 Fixed in 1.2.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-37970 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID dc50c5ee5e06 Credits Abdi Pranata Required...

WordPress Yet Another Stars Rating Plugin <= 3.3.8 is vulnerable to Race Condition

Software Yet Another Stars Rating Type Plugin Vulnerable versions = 3.3.8 Fixed in 3.3.9 OWASP Top 10 A5: Broken Access Control Classification Race Condition CVE CVE-2023-37867 Patch priority Low CVSS severity Low 3.7 Developer Claim ownership PSID 9a9795e352fc Credits Abdi Pranata Required...

WordPress Buy Me a Coffee Plugin <= 3.7 is vulnerable to Broken Access Control

Software Buy Me a Coffee Type Plugin Vulnerable versions = 3.7 Fixed in 3.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-2078 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 4f9e072d5272 Credits Lana Codes Required privilege...

getMerkleRoot() might return an unconfirmed root.

Lines of code Vulnerability details Impact Users might claim rewards using an unconfirmed merkle root. Proof of Concept getMerkleRoot returns the merkle root to claim the rewards. function getMerkleRoot public view returns bytes32 if block.timestamp = endOfDisputePeriod return tree.merkleRoot; el...